From nobody Thu Apr 2 01:15:57 2026 Received: from mail-oo1-f69.google.com (mail-oo1-f69.google.com [209.85.161.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4614C1D5170 for ; Tue, 31 Mar 2026 01:04:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774919076; cv=none; b=ZAzLqv2lXALyFS7B6bA6sK4KHw5c9oTeVtlpKxYMteVDx60HzF+EvRE5WjN+ggmhbfHnakhfwoUN/AGmiNsf2A0M4gMOtcxt/kaAOujjW7FUTpg9gowPubuUxby/PAIsP5hMnMLHwRsXd2c9yNdEH88/dFwSmn1MLTGQoAQ5NLc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774919076; c=relaxed/simple; bh=gH2AXz/dz05IivsRtpIaNWhi8JpxkczQVhmYN7dI9r8=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=lyi4JyaDm4iwmSL19ywbDqaa9b8j0IDid0heqx7guTeK5DDasJznhHpI0hazOw2BMVyKY1oWhSZ+hjXUTV4nwXump4XhUH3y/aiNOBShYx5YwHYdMHKmJQxhQqvITguEJUBfuSMIUzQ3v9ElQUDpX1x0CNUsfI2SAkJqx3lv5r4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-67e1cbc56abso12594241eaf.0 for ; Mon, 30 Mar 2026 18:04:35 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774919074; x=1775523874; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=mwoXU7X2rlq+gorXxFVZltLqCiEftsjKVujnWG23Apg=; b=PDCfl8LYOJtF+uVlAm3ldXmdteQTZzSATpV6QtgPF8zeOCA/XrTxK62Vptl9Lne67r 0mBlrBqLEDMPIGMGGzyv8vppLfu+KuPQCPACL4JerY7ARE5uA13Jk6StXVbCtvrVx4XH H1eCoxm473kNIwXFOx5S7hrBkRLRHPXomkXIXWc0UY5t84zkKE4HpLzcN0L+an3uCy1o 0itcttu+wDdzWZhCQ6Hyl172CPW4i2Co5cV+Z0WpXCYNMnuq7FnSWlqGxw9JG3r/1R7G mpPxq7uwn+1qh9QYt+Q/s22sOff7+UWTHkI6q1P3hkZ2svqexxUaKYVKHSauPLaw7eIJ zLtQ== X-Gm-Message-State: AOJu0YykbXtlptYnm60u2+wM3SpBuLHGulevIil403FOf7JGNItoFrZt 0rOsAGbJywf9bVq6dzVUB36Ag8yoCEfvZ8R4zst0a2wFPBvf75fLM6Uk4rVZvk72riFmAQrgDAI oUuZCrRkCqSNOr6PSS7v33W3X+KDRYZc+wzEiMjYSw3E3KRdRvKxf8LNqJU0= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a4a:e841:0:b0:67d:e8c1:35ad with SMTP id 006d021491bc7-67e185f6098mr7854216eaf.14.1774919074177; Mon, 30 Mar 2026 18:04:34 -0700 (PDT) Date: Mon, 30 Mar 2026 18:04:34 -0700 In-Reply-To: <699b9b6f.a70a0220.2c38d7.0189.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69cb1da2.a70a0220.97f31.0229.GAE@google.com> Subject: Forwarded: [PATCH] loop: block changing lo_offset/lo_sizelimit on mounted device From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] loop: block changing lo_offset/lo_sizelimit on mounted dev= ice Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git= master LOOP_SET_STATUS{64} allows changing lo_offset and shrinking lo_sizelimit while a filesystem is mounted on the loop device. This effectively mutates the data visible to the mounted filesystem, which is equivalent to writing directly to the block device. When CONFIG_BLK_DEV_WRITE_MOUNTED is disabled, direct writes to a mounted block device are blocked. However, LOOP_SET_STATUS{64} bypasses this protection because it modifies the loop configuration through an ioctl rather than opening the block device for writing. Fix this by checking bdev_writes_blocked() before allowing changes to lo_offset or shrinking lo_sizelimit. If the loop device has writes blocked, return -EBUSY. Increasing lo_sizelimit is still allowed since growing the device is harmless and has legitimate use cases such as online resize. Move bdev_writes_blocked() from block/bdev.c to include/linux/blk_types.h as a static inline function so it can be used from the loop driver without exporting a symbol. Reported-by: syzbot+fb32afec111a7d61b939@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Dfb32afec111a7d61b939 Signed-off-by: Deepanshu Kartikey --- v2: - Use #ifndef CONFIG_BLK_DEV_WRITE_MOUNTED instead of exporting bdev_writes_blocked(), as suggested by Ted Ts'o - Move bdev_writes_blocked() to include/linux/blk_types.h as static inline instead of exporting from block/bdev.c, as suggested by Christoph Hellwig - Allow increasing lo_sizelimit since growing the device is harmless, as pointed out by Christoph Hellwig - Remove spurious empty line --- block/bdev.c | 5 ----- drivers/block/loop.c | 16 ++++++++++++++++ include/linux/blk_types.h | 5 +++++ 3 files changed, 21 insertions(+), 5 deletions(-) diff --git a/block/bdev.c b/block/bdev.c index ed022f8c48c7..e0bace1a6c27 100644 --- a/block/bdev.c +++ b/block/bdev.c @@ -860,11 +860,6 @@ void blkdev_put_no_open(struct block_device *bdev) put_device(&bdev->bd_device); } =20 -static bool bdev_writes_blocked(struct block_device *bdev) -{ - return bdev->bd_writers < 0; -} - static void bdev_block_writes(struct block_device *bdev) { bdev->bd_writers--; diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 0000913f7efc..34bbbf3bcb36 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1239,6 +1239,22 @@ loop_set_status(struct loop_device *lo, const struct= loop_info64 *info) goto out_unlock; } =20 +#ifndef CONFIG_BLK_DEV_WRITE_MOUNTED + /* + * Changing lo_offset or shrinking lo_sizelimit on a mounted + * device is equivalent to modifying the block device contents. + * Block this if writes to the device are blocked. + */ + if ((lo->lo_offset !=3D info->lo_offset || + (info->lo_sizelimit && + (lo->lo_sizelimit =3D=3D 0 || + info->lo_sizelimit < lo->lo_sizelimit))) && + bdev_writes_blocked(lo->lo_device)) { + err =3D -EBUSY; + goto out_unlock; + } +#endif + if (lo->lo_offset !=3D info->lo_offset || lo->lo_sizelimit !=3D info->lo_sizelimit) { size_changed =3D true; diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index 8808ee76e73c..82ece8737b85 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -84,6 +84,11 @@ struct block_device { #define bdev_whole(_bdev) \ ((_bdev)->bd_disk->part0) =20 +static inline bool bdev_writes_blocked(struct block_device *bdev) +{ + return bdev->bd_writers < 0; +} + #define dev_to_bdev(device) \ container_of((device), struct block_device, bd_device) =20 --=20 2.43.0